NuHF Claw: A Risk Constrained Cognitive Agent Framework for Human Centered Procedure Support in Digital Nuclear Control Rooms

This paper introduces NuHF Claw, a novel cognitive agent framework that integrates real-time risk-constrained reasoning with probabilistic safety assessments to proactively support human operators in digital nuclear control rooms while preventing unsafe autonomous behaviors and preserving human decision authority.

The Gist

Imagine you are the captain of a massive, high-tech spaceship (a nuclear power plant). In the old days, your dashboard was full of physical levers, buttons, and analog gauges. If something went wrong, you could feel the vibration, see the needle jump, and grab the right lever.

But today, your dashboard is a giant, complex touchscreen. You don't just "push a button"; you have to navigate through menus, scroll through layers of data, and type commands. This is called "Soft Control."

The problem? This new way of working is tricky. It's easy to get lost in the menus, forget what you were doing, or get overwhelmed by too much information. This is where human error happens—not because you are bad at your job, but because the interface is confusing.

Enter NuHF-Claw, the new "Co-Pilot" designed to save the day.

The Problem: The "Smart" Robot That Might Go Crazy

Scientists have been trying to build AI assistants to help captains like you. But there's a big catch: Modern AI (like the chatbots you know) is great at talking, but it can "hallucinate." It might confidently tell you to do something dangerous because it made up a fact. Also, if you let the AI take full control, you lose your authority as the captain.

We need an AI that is smart enough to help, but strictly controlled so it never makes a dangerous mistake and never takes the wheel away from you.

The Solution: NuHF-Claw (The "Risk-Constrained" Co-Pilot)

Think of NuHF-Claw not as a robot that drives the ship, but as a super-smart, hyper-vigilant navigator sitting right next to you. It has four special "brains" working together:

1. The Digital Twin (The "Ghost in the Machine")

Imagine a ghost version of yourself that lives inside the computer. This is the Cognitive Twin.

• How it works: While you are staring at the screen, trying to find a valve in a menu, this ghost is simulating your brain in real-time. It knows exactly how long it takes for your brain to process information, how tired you are, and if you are about to get confused.
• The Magic: In the past, building this ghost required a human to write thousands of lines of complex code. NuHF-Claw uses a special AI to write that code instantly, creating a "living" model of your brain that updates every second.

2. The Map Reader (The "Procedure Interface")

When an emergency happens, you have a thick manual (a PDF) telling you what to do.

• How it works: The Procedure-Interface Agent reads that manual and instantly turns it into a digital map. It doesn't just read the words; it knows exactly where on the screen the buttons are. It connects the text "Turn off Valve A" to the exact pixel coordinates on your screen.
• Why it matters: It stops the AI from guessing. It forces the AI to stick to the real map, preventing it from making up fake buttons.

3. The Risk Calculator (The "Safety Auditor")

This is the Dynamic Risk Agent.

• How it works: It looks at the current situation. Is the plant shaking? Are you stressed? Is the task complicated? It calculates the probability of you making a mistake right now.
• The Math: It uses a special formula (based on IDHEAS) to say, "Hey, the captain is tired and the screen is confusing. The chance of a mistake is 15%."

4. The Gatekeeper (The "Governance Safety Gate")

This is the most important part. It's the bouncer at the club.

• How it works: The AI might want to suggest a solution. But before it can speak, it has to ask the Gatekeeper: "Is it safe to say this?"
• The Decision:
  • Low Risk: If the captain is fresh and the task is easy, the Gatekeeper says, "Go ahead, suggest the next step."
  • High Risk: If the captain is stressed or the task is dangerous, the Gatekeeper slams the door. It says, "No! The AI cannot do this. I will show you the path, but YOU must click the button."

How It Works in Real Life (The Story)

Imagine a fire alarm goes off in the spaceship.

1. The Alarm: The system detects the problem instantly (Perception).
2. The Map: The AI reads the emergency manual and highlights the path on your screen (Procedure-Interface).
3. The Ghost: The "Ghost of You" realizes that because the alarm is loud and the screen is flashing, you are likely to get confused and click the wrong menu (Cognitive Twin).
4. The Risk: The Risk Calculator says, "There is a 40% chance the Captain will panic and click the wrong thing."
5. The Gate: The Gatekeeper intervenes. Instead of letting the AI fix it automatically, it says to the Captain: "Captain, I see you are under high stress. I have highlighted the correct valve on the screen. You must verify and click it. Do not let the AI do it for you."

Why This is a Big Deal

• It's not about replacing humans: It's about Human-Centered Autonomy. The AI does the heavy mental lifting (calculating risks, reading manuals), but the human keeps the final say.
• It stops "Hallucinations": By forcing the AI to check against a real map and a safety gate, it can't make up dangerous facts.
• It's proactive: Old safety systems waited for an accident to happen to learn from it. NuHF-Claw watches you while you work and stops the accident before it happens.

The Bottom Line

NuHF-Claw is like having a super-intelligent, paranoid safety coach who knows your brain better than you do. It watches your every move, calculates your stress levels, and ensures that even if you get tired or confused, the AI won't let you make a fatal mistake. It turns the scary idea of "AI taking over" into a safe partnership where the human remains the captain, and the AI is the ultimate co-pilot.

Technical Summary

1. Problem Statement

The transition of nuclear power plant Main Control Rooms (MCRs) from analog to digital interfaces has introduced a phenomenon known as "soft control." Unlike traditional physical controls, soft control requires operators to navigate complex digital menus, manage information density, and interpret system states through software layers. This shift has led to:

• New Cognitive Error Modes: Increased risks of mode confusion, navigation disorientation, and cognitive overload, which traditional Human Reliability Analysis (HRA) methods fail to capture effectively.
• Limitations of Existing HRA: Current HRA methodologies (e.g., THERP, ATHEANA, CREAM) are largely offline, retrospective, and static. They cannot provide real-time intervention or dynamic risk assessment during active operations.
• Risks of Unconstrained AI: While Large Language Models (LLMs) and autonomous agents offer decision support, their direct deployment in safety-critical environments is hindered by the risk of "hallucinations" (generating plausible but unsafe instructions) and the potential erosion of human decision-making authority.

There is an urgent need for a framework that bridges dynamic HRA with autonomous AI, ensuring that AI agents act as risk-constrained cognitive co-pilots rather than autonomous dictators.

2. Methodology: The NuHF-Claw Framework

NuHF-Claw is a persistent, multi-agent runtime designed to operate continuously in the background of digital MCRs. It transforms static reliability evaluation into a proactive, risk-governed mechanism. The framework consists of four synergistic agents and a governance layer:

A. Core Architecture Components

1. MCR Digital Twin Environment (Perception Layer):

   • Utilizes a high-fidelity simulator (HTR-PM600) and continuous telemetry data (33 operational parameters).
   • Employs Long Short-Term Memory (LSTM) networks to automatically diagnose initial events (e.g., generator disconnection) in real-time, triggering the agent workflow.

2. Procedure-Interface Agent (Task Modeling):

   • Powered by the AutoGraph framework.
   • Parses textual Emergency Operating Procedures (EOPs) and maps them to a dynamic Interface-Embedded Knowledge Graph (IE-KG).
   • Transforms unstructured text into machine-executable, coordinate-grounded operational paths, preventing LLM deviations by grounding actions in a deterministic graph.

3. Cognitive Twin Agent (Human Modeling):

   • Based on the ACT-R (Adaptive Control of Thought—Rational) cognitive architecture.
   • Innovation: Instead of manual Lisp coding, the system uses an LLM to automatically generate ACT-R Lisp code based on real-time operational paths.
   • Simulates the operator's cognitive trajectory (visual search, memory retrieval, motor execution) to predict Time Required ($T_{reqd}$) and identify cognitive bottlenecks (e.g., mode confusion).
   • Calculates time-dependent human error probability ($P_t$) using log-normal distributions.

4. Dynamic Risk Agent (Contextual Analysis):

   • Powered by KRAIL (Knowledge-based Reliability Analysis using an Intelligent Large Language Model).
   • Grounded in the IDHEAS-ECA methodology.
   • Analyzes real-time Performance Influencing Factors (PIFs) (e.g., workload, stress, complexity) to calculate a contextual cognitive failure probability ($P_c$).

5. Governance Safety Gate (Decision Control):

   • The critical safety mechanism that prevents AI overreach.
   • Uses a Bayesian Network (BN) to synthesize $P_t$ (time risk) and $P_c$ (cognitive risk) into a holistic Action Risk Probability.
   • Logic: If the inferred risk exceeds predefined safety thresholds, the system blocks autonomous execution, generates a risk-aware suggestion, and enforces human approval before any action is taken.

B. Architectural Principles

• Explainability: Actions are grounded in knowledge graphs and IDHEAS theory, making the "why" of a recommendation auditable.
• Human-Centered Autonomy: The system augments human capability but preserves the operator's ultimate decision authority.
• Modularity: Independent agent layers isolate potential LLM hallucinations.
• Persistence: Operates continuously in real-time, unlike post-event HRA tools.

3. Key Contributions

• Bridging HRA and AI: NuHF-Claw is the first framework to integrate dynamic HRA (IDHEAS) with autonomous agent runtimes, creating a "Risk-Constrained Agent Runtime."
• Automated Cognitive Twin Generation: It solves the scalability bottleneck of cognitive modeling by using LLMs to dynamically generate ACT-R code, enabling a persistent, real-time "Human Digital Twin" without manual coding.
• Proactive Risk Governance: It shifts HRA from passive observation to active intervention, using probabilistic safety gates to constrain AI behavior based on real-time cognitive states.
• Soft Control Mitigation: Specifically addresses the cognitive vulnerabilities introduced by digital interfaces (navigation complexity, mode confusion) through continuous monitoring and dynamic risk assessment.

4. Experimental Results

The framework was validated using the HTR-PM600 full-scope simulator with three nuclear engineering graduate students performing reactor shutdown procedures under time pressure.

• Cognitive Workload Prediction: The Cognitive Twin Agent accurately predicted workload disparities among operator roles (1RO, 2RO, 3RO). The model showed high stability ($R^2 > 0.9$), correctly identifying that the primary operator (1RO) faced critical peaks in mental workload (score 55.83) compared to others.
• Validation of Digital Twin: The execution time distributions ($T_{reqd}$) generated by the automated ACT-R model tightly aligned with empirical cursor-tracking data collected from participants.
• Risk Awareness: The system successfully identified high-risk navigational nodes (e.g., sequences requiring 11 consecutive interactions) that induce mode confusion.
• Governance Efficacy: The Governance Layer successfully intercepted high-risk scenarios, converting them into "Action Suggestions" requiring human confirmation, thereby preventing potential autonomous errors while maintaining operational flow.

5. Significance and Future Directions

Significance:
NuHF-Claw represents a paradigm shift from automation-driven operation to cognition-aware autonomy. It provides a principled pathway for integrating intelligent agents into safety-critical nuclear environments by ensuring that AI reasoning is strictly bounded by probabilistic safety constraints and human cognitive limits. It effectively mitigates the "black box" nature of LLMs in high-stakes scenarios.

Future Research:

• Multimodal Calibration: Integrating physiological data (eye-tracking, EEG) to refine the Cognitive Twin's accuracy.
• Latency Optimization: Developing lightweight surrogate models to ensure microsecond-level responsiveness during severe accidents.
• Team Dynamics: Scaling the framework to model multi-operator crew coordination and communication failures.
• Closed-Loop Deployment: Moving from research prototypes to industrial-grade, closed-loop simulator campaigns with active control room crews.